Privacy Policy

1. Who we are

Luma Digital Marketing (“Luma”, “we”, “us”, “our”) is a digital marketing agency based in Durbanville, South Africa, providing services including web design, search engine optimisation (SEO), paid advertising, social media management, photography, Google Analytics setup, and email marketing.

We are committed to protecting your personal information. This policy explains what data we collect, why we collect it, and how we handle it — in accordance with the Protection of Personal Information Act (POPIA), Act 4 of 2013, and, where applicable, the EU General Data Protection Regulation (GDPR).

This policy covers both our public website at lumadigital.co.za and our client portal, including the forms we send to prospective and existing clients.

Responsible Party / Data Controller: Lara Husselmann, Luma Digital Marketing, company registration number 2026/006277/07.
Contact: lara@lumadigital.co.za

2. Information we collect

We collect personal information in the following ways:

a) When you contact us through our website

• Contact form: first name, surname, email address, and your message.
• Newsletter sign-up: email address, if you opt in.
• Direct contact: anything you include when you email us, phone us, or message us on WhatsApp.
• Website audit requests: the web address you ask us to check. We send that address to Google's PageSpeed Insights service to produce the report.

b) When you fill in one of our forms

Before we quote, we send a Needs Analysis form, and for design work a Brand and Content Brief. These are opened from a private link and do not require an account. Through them we collect:

• Your contact and business details: name, company name, email address, phone number, physical address, VAT status, and how you prefer to be contacted.
• Your answers: what you told us about your business, your customers, your competitors, your goals, your timelines and your budget.
• Files you upload: logos, photographs, documents and any other material you choose to send us through the form.
• A record of submission: the date and time you submitted, your IP address, and your browser type. We keep this as evidence of what was sent and when, and of the privacy consent you gave.

c) When you become a client

• Account details: your name, email address and a password you set, so you can sign in to the client portal.
• Business and billing details: registered company name, company registration number, VAT number, billing address, and the name and contact details of your own Information Officer where you have one.
• Documents: quotes, invoices, statements, project briefs, tasks and website reviews.
• Signature records: when you accept a quote or sign an agreement online, we record your typed or drawn signature, your name, your email address, your IP address, the date and time, and a digital fingerprint of the exact document you signed. This is what makes an electronic signature enforceable, and we cannot provide the signing service without it.

d) Photographs

Where you engage us for photography, or send us photographs to use, we handle images that may show identifiable people — your staff, your customers or members of the public. See section 9 for how we treat these.

e) Information collected automatically

• Analytics data: pages visited, time on site, traffic source, device type, browser, and approximate location (country/city), collected via Google Analytics 4. See section 8 for exactly what runs before and after you answer our cookie banner.
• Advertising data: Google Ads measures whether an advert led to an enquiry. If you consent to marketing cookies, the Meta Pixel does the same for Facebook and Instagram advertising.
• Technical data: IP address, HTTP request headers, and similar information that our hosting provider collects as part of delivering the website to you.

We do not run analytics or advertising scripts inside the client portal, or on any private form, quote or signing page. Those pages carry information about identifiable clients, and the web address alone would tell an advertising network more than it should know.

3. How we use your information

• To respond to your enquiry — when you fill in our contact form, we use your name and email address to reply to you.
• To prepare your quote — everything you tell us in the Needs Analysis is used to work out what you need and what it should cost. It is not used for anything else.
• To do the work and run the account — managing your project, producing the work, invoicing you, and keeping the records a business is required to keep.
• To send our newsletter — only if you have explicitly opted in. You can unsubscribe at any time using the link in every email.
• To improve our website — analytics data helps us understand how visitors use the site so we can make it more useful.
• To measure advertising performance — so we know whether our own advertising is reaching the right people.
• To show our work — only within the limits set out in section 9.
• To comply with legal obligations — including tax and company record-keeping.

We do not sell your personal information, and we do not use what you tell us in a form to market to you unless you separately opted in.

4. Legal basis for processing

Under POPIA (section 11) and the GDPR (Article 6), we rely on the following lawful grounds:

• Consent — for marketing cookies, newsletter communications, and the use of your work or photographs in our portfolio. You can withdraw consent at any time.
• Performance of a contract — to prepare your quote, do the work you have engaged us for, and invoice you.
• Legitimate interests — to respond to enquiries you initiate, to keep our website secure, and to understand how our website and advertising perform.
• Legal obligation — where processing is required by applicable law, such as retaining tax records.

5. How long we keep your data

Where a legal retention period applies, we keep the record for that period even if you ask us to delete it, and delete it once the period ends.

6. Third parties we share data with

We do not sell your personal information. We share data only with trusted third-party service providers, and only to the extent necessary to operate our services:

We may also share information with our accountant, our bank, or our legal advisers where necessary, and with anyone you have specifically asked us to deal with on your behalf.

Where data is transferred outside South Africa, we take steps to ensure adequate protection consistent with POPIA section 72 requirements. If we change providers, we update this table.

7. Your rights

Under POPIA and, where applicable, the GDPR, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct any inaccurate or incomplete information.
• Deletion — request that we delete your personal information, subject to the legal retention requirements in section 5.
• Objection — object to the processing of your information where we rely on legitimate interests.
• Restriction — ask us to limit how we process your information in certain circumstances.
• Portability — receive a copy of the information you provided to us in a structured, machine-readable format (GDPR).
• Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please email us at lara@lumadigital.co.za. We will respond within 30 days. If you are based in South Africa and believe your rights have been violated, you may lodge a complaint with the Information Regulator of South Africa. EU residents may also contact their local supervisory authority.

8. Cookies and tracking

We use cookies and similar technologies on our public website. Our cookie banner lets you choose which categories you accept:

• Strictly necessary — essential for the website to function, including remembering your cookie choice and keeping you signed in to the client portal. These cannot be disabled.
• Analytics — help us understand how visitors use our site (Google Analytics 4).
• Marketing — used by Google Ads and the Meta Pixel to measure advertising effectiveness.

What runs before you answer the banner

We want to be precise about this, because it is the part most policies gloss over.

• Google runs in what Google calls advanced consent mode. Its tag loads on every public page as soon as you arrive, but with all storage denied: it sets no cookies and cannot identify you. It sends anonymous, cookieless signals about the visit. If you accept analytics or marketing cookies, storage is enabled and normal measurement begins. If you decline, it stays in the cookieless state.
• The Meta Pixel does not load at all until you accept marketing cookies. Nothing is sent to Meta before that.
• Neither runs in the client portal, or on any private form, quote, signing or review page.

You can change your cookie preferences at any time by clicking the “Cookie settings” link in the footer. Withdrawing consent switches Google's storage back off and stops the Meta Pixel loading.

Every cookie this site sets is listed by name, purpose and lifespan in our cookie policy.

9. Photography, images and our portfolio

Photography is part of what we do, so images need their own rules.

• Photographs of identifiable people. A photograph of a recognisable person is personal information under POPIA. Where we photograph your staff, your customers or members of the public on your behalf, you are responsible for obtaining their consent before the shoot, and for telling them how the images will be used. We will not publish an image of an identifiable person where that consent has not been given, and we will remove one on request.
• Images you send us. When you upload photographs, logos or other material, you confirm that you own them or have the right to use them, and that any people shown have agreed to appear. We rely on that confirmation.
• Copyright and licensing. Copyright in photographs we take remains with Luma Digital Marketing unless your written agreement with us says otherwise. What you may do with the images — where, for how long, and in what media — is set out in the licence in your quote or agreement. Stock images we buy on your behalf carry the licence terms of the stock library, which we pass on to you.
• Our portfolio. We would like to show the work we do for you on our website, in proposals and on social media. We will only do so where you have agreed to it in your agreement with us, or given us written permission. You can withdraw that permission at any time by emailing us, and we will take the work down from anything we control within 30 days. Material already printed, or already published by somebody else, may not be recoverable.
• Confidential work. If a project is confidential, tell us and it will never appear anywhere.

10. How we protect your information

We take reasonable technical and organisational measures to protect your personal information, including:

• Encryption in transit — the website and portal are served over HTTPS only.
• Access to client data restricted to people who need it, and separated by role.
• Private form links that expire, and that only ever open the one record they name.
• Files uploaded to us stored in access-controlled storage, never sent around by email.
• Reputable providers who maintain their own security standards, listed in section 6.

No system is perfectly secure, and we cannot guarantee absolute security. If you have an account with us, please use a strong, unique password.

11. If something goes wrong

If personal information in our care is accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify the Information Regulator, and to notify you, as soon as reasonably possible after discovering it. We will tell you what happened, what information was involved, what we are doing about it, and what you can do to protect yourself.

12. Children's privacy

Our website and services are not directed at children under the age of 18 and we do not knowingly collect personal information from children. Where a child appears in photography we produce, we require the consent of a parent or guardian. If you believe a child has submitted information to us, please contact us and we will delete it promptly.

13. Changes to this policy

We may update this policy from time to time — for example, if we change a service provider or add a service. When we do, we will revise the “last updated” date at the top of this page.

If a change materially affects how we handle information we already hold about you, we will tell you directly rather than relying on you noticing this page. Where we rely on your consent, a change never takes effect through your continued use of the site: we will ask you again.

14. Contact us

If you have any questions about this privacy policy or how we handle your data, please contact our Information Officer: